More API authentication work - incomplete